Envoy up to 1.22.8/1.23.5/1.24.3/1.25.2 ext_authz Filter input validation

Summaryinfo

A vulnerability categorized as critical has been discovered in Envoy up to 1.22.8/1.23.5/1.24.3/1.25.2. Affected is an unknown function of the component ext_authz Filter Handler. Such manipulation leads to input validation. This vulnerability is referenced as CVE-2023-27488. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Envoy up to 1.22.8/1.23.5/1.24.3/1.25.2 and classified as critical. Affected by this issue is an unknown functionality of the component ext_authz Filter Handler. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service. When Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests. As of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`.

The weakness was published 04/05/2023 as GHSA-9g5w-hqr3-w2ph. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-27488 since 03/01/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.22.9, 1.23.6, 1.24.4, 1.25.3 or 1.26.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Envoy

Version

• 1.22.0
• 1.22.1
• 1.22.2
• 1.22.3
• 1.22.4
• 1.22.5
• 1.22.6
• 1.22.7
• 1.22.8
• 1.23.0
• 1.23.1
• 1.23.2
• 1.23.3
• 1.23.4
• 1.23.5
• 1.24.0
• 1.24.1
• 1.24.2
• 1.24.3
• 1.25.0
• 1.25.1
• 1.25.2

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion